SA 260 is about useful communication during the audit, not a routine closing letter. The auditor has to identify the right governance recipients, tell them what the audit will cover, discuss important findings in time, and keep evidence of the communication.
The current ICAI Engagement and Quality Control Standards repository, updated on 13 May 2026, lists Revised SA 260. The official Revised SA 260 text applies to audits of financial statements for periods beginning on or after 1 April 2017.
Start by identifying those charged with governance
“Those charged with governance” means the person or group that oversees the entity’s strategic direction and accountability, including the financial reporting process. The answer depends on the entity. It may be the board, an audit committee, partners, trustees, a proprietor, an owner-manager or another governing body.
The auditor must choose the appropriate recipient for each matter. If a matter is discussed only with a subgroup such as the audit committee, the auditor should decide whether the full governing body also needs it. A subgroup is not automatically a substitute for the board.
In a small owner-managed entity, the same person may perform both management and governance roles. SA 260 does not require the same matter to be repeated merely under a different label, but the auditor must be satisfied that everyone who should receive it in a governance capacity has been adequately informed.
Use a communication matrix instead of one generic memo
| Matter | What governance should understand | Usual timing | Form under SA 260 |
|---|---|---|---|
| Auditor’s responsibilities | The auditor forms and expresses an opinion; management prepares the financial statements under governance oversight. The audit does not transfer those responsibilities. | At or near engagement planning | May be included in an engagement letter or another suitable communication |
| Planned scope, timing and significant risks | Where the audit will focus, important milestones and why identified risks need special audit attention | Early enough to help governance oversight | Oral or written, depending on the engagement |
| Significant audit findings | Important accounting practices, difficulties, management discussions, requested representations, reporting consequences and other significant matters | As matters arise and before reporting decisions are finalised | Written when oral communication would not be adequate |
| Independence for a listed entity | Compliance with independence requirements, relevant relationships, audit and non-audit fees by useful categories, and safeguards applied | In time for governance to assess independence | Written |
| Adequacy of two-way communication | Whether the auditor received relevant information and governance could understand and respond to significant matters | Throughout the audit and evaluated at completion | Document the evaluation and any response to ineffective communication |
The auditor should also explain the expected form, timing and general content of communications. This avoids uncertainty about who will receive planning discussions, emerging issues and final findings.
Explain scope without giving away the audit programme
SA 260 requires an overview of planned scope and timing, including significant risks identified by the auditor. The discussion may cover how significant or higher risks will be addressed, the approach to relevant internal control, materiality, use of specialists, internal audit coordination and—where SA 701 applies—areas that may need significant auditor attention.
Governance needs enough information to oversee the financial reporting process, but not a predictable list of detailed procedures. For example, if revenue recognition is a significant risk, the auditor may explain that unusual contracts, manual entries and year-end cut-off will receive attention. The auditor need not disclose sample selections or every test step.
Know the significant findings that must be raised
SA 260 requires communication of the auditor’s views on significant qualitative aspects of accounting practices, including policies, estimates and disclosures. If a technically acceptable practice is not the most appropriate choice for the entity’s circumstances, the auditor explains that view.
The auditor also communicates significant difficulties encountered during the audit. Unless everyone charged with governance is involved in management, communication includes significant matters discussed or corresponded about with management and the written representations being requested. Circumstances affecting the form or content of the auditor’s report, and other significant matters relevant to financial reporting oversight, are also covered.
Internal-control deficiencies need a related but separate analysis. Use the SA 265 internal-control deficiencies guide to decide whether a finding must be reported in writing to governance and management.
Run the communication through three practical stages
| Stage | What to communicate | Evidence to retain |
|---|---|---|
| Planning | Recipients, auditor responsibilities, planned scope and timing, significant risks, communication protocol and expected general content | Engagement letter, planning presentation, meeting agenda or minutes |
| Fieldwork | Significant difficulties, delayed information, contentious accounting issues and emerging matters needing governance action | Issue log, emails, minutes and follow-up responsibilities |
| Completion | Significant findings, requested representations, reporting implications, unresolved matters and listed-entity independence communication | Governance letter, final presentation, signed minutes and resolution tracker |
“Timely” depends on the matter. A delay affecting audit evidence should be raised while governance can still intervene. A reporting consequence should be explained before the auditor’s report is issued. Saving everything for the final meeting may make the communication formally complete but practically useless.
Worked example: one issue, four communication decisions
Assume a listed company is changing its revenue system shortly before year-end. During planning, the auditor identifies revenue recognition and system migration as significant risks.
- Planning: explain the risk areas, high-level audit response and timing to the audit committee without revealing detailed test selections.
- Fieldwork: management repeatedly delays the migration reconciliation. Communicate the significant difficulty promptly and agree who will remove the obstacle.
- Completion: explain the auditor’s view on the revenue policy, any unresolved misstatements, requested representations and the effect on the auditor’s report.
- Independence: give the listed-entity written statement, relevant relationships, properly categorised audit and non-audit fees, and safeguards applied.
If the migration also reveals significant control deficiencies, the SA 265 written communication is prepared separately or clearly identified within the wider governance communication. Do not let a broad SA 260 presentation hide the specific content required by SA 265.
Written and oral communication: what is actually required?
Not every SA 260 matter must be written. Significant findings must be communicated in writing when, in the auditor’s professional judgment, oral communication would not be adequate. The listed-entity independence communication is written. Other matters may be communicated orally when that is effective in the circumstances.
Where a required matter is communicated orally, the audit file records what was communicated, when and to whom. A copy of every written communication is retained. The related SA 230 documentation guide explains how to keep a reviewable evidence trail rather than relying on a “discussed” tick mark.
What if communication is not effective?
The auditor must evaluate whether two-way communication was adequate for the audit. Warning signs include repeated non-response, important information reaching governance too late, unclear responsibility for follow-up, or management filtering matters that should go directly to governance.
If communication is inadequate, the auditor considers its effect on the assessment of material-misstatement risks and the ability to obtain sufficient appropriate audit evidence, then takes appropriate action. Depending on the facts, that may include changing the audit response, escalating to a different governance level, considering legal or regulatory responsibilities, or seeking legal advice.
Law or regulation may sometimes restrict communication—for example, where disclosure could prejudice an official investigation. Confidentiality and communication duties can conflict, so the auditor should not improvise around a legal restriction.
Final SA 260 file check
- Identify the governance recipient for each matter and explain why that person or body is appropriate.
- Decide whether communication with a subgroup must also reach the full governing body.
- Communicate auditor responsibilities, scope, timing and significant risks early enough to be useful.
- Track significant findings, difficulties, management discussions, representations and reporting consequences.
- Complete the listed-entity written independence communication when applicable.
- Record oral communications and retain copies of written communications.
- Follow up governance responses and unresolved matters.
- Conclude whether two-way communication was adequate and record the effect of any weakness.
A good SA 260 record answers four questions without guesswork: who received the matter, what they were told, when it was communicated and what happened next. That makes the communication useful to governance and defensible in the audit file.
